Modeling and learning incident prioritization
Leonard Renners, Felix Heine, Gabi Dreo Rodosek · 2017
With the ever rising amount of security and alert information, the decision process which incident to address first becomes increasingly important and prioritizing incidents is a common approach towards this problem. Meanwhile, networks and policies have a dynamic and complex nature. Machine learning techniques have successfully been applied in the area of intrusion detection systems (IDS) to cope with similar challenges. We therefore propose a generic rule model for incident prioritization and apply supervised learning to induce the priority calculation rules.